A company should have policies in place to govern the collection, storage, sharing, and retention of data being collected by its employees. All employees should understand these policies. A company should think about all the ways in which it collects data:
From Web site visitors or online commerce
Product registration and magazine subscriptions
Business cards left at conferences and workshops
Notes from customer meetings
Mailing lists purchased from other companies
Is this collection being tracked in a way that can be audited from a corporate group? Is this collection being done in a consistent fashion across the company? Is the company even aware of all the places where data is being collected? ...